For each requirement of a catalogue, you decide whether it applies to your organisation and justify that decision. These decisions form the Statement of Applicability (SoA), which a second person approves. This guide is aimed at ISMS managers and everyone who manages requirements.

Before you start

  • You need an adopted or custom catalogue, see Adopting requirement catalogues.
  • People with the “Manage requirements (incl. applicability)” permission may set applicability and create versions; by default, these are the ISMS managers.
  • Another person with the “Approve Statement of Applicability” permission may approve; by default, this is top management.
  • For ISO/IEC 27001 Annex A, it helps if risk treatment is already in place: requirements implemented by a measure of the risk treatment are then considered included with justification.
  1. ISMS managerSet applicability

    Per requirement, with justification.

  2. ISMS managerCheck cross-check

    Resolve blocking points.

  3. ISMS managerCreate version

    Varmo freezes the current state.

  4. Top managementApprove

    Never the person who created the version.

Rejected

The person who created it receives a task to revise it.

Changed later

For significant changes, the task “Update Statement of Applicability” is created.

From applicability to the approved statement

Four steps: set and justify the applicability of each requirement. Resolve the blocking points in the cross-check. Create a version; Varmo freezes the current state. Another person approves the version, by default top management. If it is rejected, the person who created it revises the version. If something significant changes later, a task to update it is created.

Setting applicability

  1. Open Requirements › Catalogues, choose the catalogue and click Set applicability.
  2. Each requirement has one of three states: Not assessed, Applicable or Not applicable. New requirements always start with “Not assessed”.
  3. For Applicable, choose a Justification for inclusion: Law or regulation, Contract, Interested party or Decision of the organisation. Varmo adds reasons from risk treatment itself; with one click you adopt these requirements as applicable.
  4. For Not applicable, write a justification, for example “No own data centre – operated entirely in the cloud”.
  5. You select several requirements or whole chapters together and decide them with the same justification. Search and filters (e.g. “Justification missing”) help with large catalogues.
  6. Finally, click Save … changes.

You can also change individual requirements directly on the requirement in the “Applicability” section.

Checking the cross-check

Under Requirements › Annex A cross-check, you see for each catalogue what still needs to be resolved before the Statement of Applicability:

  • Blocking: applicable requirements without a justification for inclusion, and excluded requirements that a risk treatment implements.
  • Guidance: applicable requirements without implementation and without a measure, threats of treated risks without a matching requirement, or requirements justified only with “Decision of the organisation”.

Creating and approving the Statement of Applicability

  1. Once all requirements have been assessed, click Create Statement of Applicability or open Requirements › Statement of Applicability and click Create version.
  2. Choose the catalogue and describe the Reason / changes, e.g. “Annual review”.
  3. Varmo freezes the current state: applicability, justifications, implementation, measures, internal controls, policies and documents. If there are blocking points from the cross-check or requirements not yet assessed, the dialog shows this and does not allow the version to be created.
  4. The approver opens the version and chooses Approve or Reject. When rejecting, they justify the decision and can add comments on individual requirements.

Whoever created a version cannot approve it themselves (four-eyes principle). At most one version per catalogue is open at a time.

What happens next

  • After creation, the people with approval permission receive a task in My tasks.
  • After approval, the version is valid and replaces the previous one. From then on, the management review shows this version.
  • After a rejection, the person who created the version receives a task to revise it.
  • If something significant changes later (new requirement, changed applicability, justification no longer valid), the page shows a notice and the task “Update Statement of Applicability” is created.

Each version can be output with Print / PDF or downloaded as CSV.

Frequently asked questions

We have already approved the SoA outside Varmo. Does that have to be done again?

No. If your organisation is continuing an existing ISMS (Settings › Organisation), choose Adopt existing approval for the first version, record who approved it and when, and upload the evidence as a PDF. A person with the “Approve Statement of Applicability” permission then confirms the adoption in Varmo (four-eyes principle); only then is the version valid. It remains marked as adopted; every further version goes through approval in Varmo.

Does the applicability automatically apply to equivalent requirements in other catalogues too?

No, it applies per catalogue. When you choose Change applicability on the requirement, you can tick a box to record the decision for identical requirements in other catalogues as well. See Mappings between catalogues.

Does every catalogue need its own Statement of Applicability?

A version always relates to one catalogue. Further catalogues supplement the statement on Annex A; they do not replace it.